Re: [PATCH] platform/x86/amd/pmf: check APTS buffer before reading header

[Mario Limonciello]

On 11/3/26 05:41, Kang Chen wrote:
> apts_if_call_store_buffer() reads a u16 length from the APTS buffer
> without checking that the buffer has at least two bytes.  The sibling
> apmf_if_call_store_buffer() performs this check.  A Buffer(0) reply
> from the APTS method makes the driver read two bytes past the ACPI
> allocation.
>
> Add the missing length check.
>
> Fixes: 3eecb434d7f2 ("platform/x86/amd/pmf: Add support to get sps default APTS index values")
> Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
> ---
>   drivers/platform/x86/amd/pmf/acpi.c | 6 ++++++
>   1 file changed, 6 insertions(+)
>
> diff --git a/drivers/platform/x86/amd/pmf/acpi.c b/drivers/platform/x86/amd/pmf/acpi.c
> index 4392bf0bc0bf..8e0d9be8c042 100644
> --- a/drivers/platform/x86/amd/pmf/acpi.c
> +++ b/drivers/platform/x86/amd/pmf/acpi.c
> @@ -137,6 +137,12 @@ int apts_if_call_store_buffer(struct amd_pmf_dev *pdev, u32 index, void *data, s
>   		goto out;
>   	}
>   
> +	if (info->buffer.length < sizeof(u16)) {
> +		dev_err(pdev->dev, "buffer too small\n");
> +		err = -EINVAL;
> +		goto out;
> +	}
> +
>   	size = *(u16 *)info->buffer.pointer;
>   	if (info->buffer.length < size) {
>   		dev_err(pdev->dev, "buffer smaller than header size %u < %zu\n",

Thanks for the patch.  But I would say there is another on the mailing 
list that does very similar and covers more:

https://lore.kernel.org/platform-driver-x86/20261005072811.1378555-1-Shyam-sundar.S-k@xxxxxxx/

It just needs to be rebased.